HaloPSA - Idemeum Docs

Integration use cases with Halo PSA

There are several integrations that we support with HaloPSA today:

  1. Create tickets for elevation requests
  2. Approve elevation requests from tickets
  3. Request JIT accounts from tickets
  4. Disable JIT accounts from HaloPSA

Create tickets for elevation requests

With this integration when users request elevations, the ticket will be automatically created in HaloPSA. When the elevation is approved (let’s say with mobile device), the ticket will be automatically closed. Inside the ticket there will be a link to navigate to idemeum and approve the request. If you want to approve the elevation request with a button click, please also read through the next section.

[**Create tickets in Halo PSA for elevation requests**
Demo of how tickets integration works with Halo PSA](https://www.youtube.com/watch?v=B-A6k9fcDS8)

Create custom fields in Halo

These fields are used to associate the request ID as well as the idemeum customer name in the ticket. These fields are mandatory if you want to use the approval from tickets with custom integration.

Configure HaloPSA agent

In this step we will create an API-only agent to use with HaloPSA application.

Now we will need to configure the proper permissions:

Configure HaloPSA application

The way HaloPSA allows other systems to make calls into their system is by creating an application.

Configure idemeum connector

Customers mapping

Once the integration with HaloPSA is added, you will see the new HaloPSA column in the Tenants section. Automatic mapping As a first step idemeum will try to automatically map the customers in idemeum to tenants in HaloPSA. Here is how we will try to do that:

  1. Use the Display Name of the customer in idemeum to search for a customer in HaloPSA
  2. If no match was found using the Display Name, then we would use the Name of the customer in idemeum to search for a customer in HaloPSA
  3. If no match was found using the Name, then the admin will have to manually link the customers

Manual mapping The admin can manually link a tenant from idemeum with one in HaloPSA by providing the name of the customer from HaloPSA.

Ticket creation

Here is how idemeum will create the tickets in HaloPSA:

  1. category - Business Applications
  2. urgency - Medium
  3. impact - Single User Affected

Approve elevation requests from tickets

By default there is a link in the ticket details that allows you to approve the elevation request. The new tab will open and you will be redirected to idemeum to approve the request. You can simplify this process by configuring an API-based integration to approve / deny the elevation request with a single click.

Create custom integration in HaloPSA

Create custom methods in Halo PSA

{
    "idemeumElevationRequestId": <<CFidemeumElevationRequestId>>, 
    "idemeumCustomerName": <<CFidemeumCustomerName>>, 
    "userElevationMode": "USER"
}

{
    "idemeumElevationRequestId": <<CFidemeumElevationRequestId>>, 
    "idemeumCustomerName": <<CFidemeumCustomerName>>
}

Create ticket actions in HaloPSA

Now we will create two custom ticket actions that will call these approve and deny methods.

Assign these methods to your workflow

This will depend on your HaloPSA configuration and what workflow you are using. We are using a standard incident workflow for our demo.

Now these methods will start showing up on your elevation request tickets and you can approve / deny requests with a single button click.

Request JIT accounts from tickets

MSP technicians can request Entra ID JIT accounts right from HaloPSA tickets. HaloPSA and idemeum integration leverages embedded iFrame sections.

By default idemeum security does not allow cross-domain requests. Therefore, to enable this integration, request idemeum team to allow embedded iFrames for your idemeum tenant.

[**Halo PSA and JIT Entra integration**
Request Entra JIT accounts right from your Halo PSA tickets.](https://www.youtube.com/watch?v=4BeWwMPesvM)

Configure session length

This step is optional, but will improve technician experience when accessing just-in-time accounts. By default the idemeum session length is set to 8 hours, meaning you have to re-authenticate with mobile every 8 hours. You can extend this session to 30 days so that you can seamlessly access JIT accounts for any customer tenant right from HaloPSA and you will stay authenticated for 30 days.

Configure HaloPSA

In HaloPSA you can create a Custom tab that will point to your idemeum tenant. When managing PSA ticket you can click on that tab and get immediate access to your idemeum portal. You have 2 options for navigation:

To support the second option you need to set up variables.

Now we will set up a custom tab.

Test integration

Disable JIT accounts from HaloPSA

Overview

Technicians can request Entra ID JIT accounts right from HaloPSA with our existing iFrame integration. However, requested JIT accounts will be disabled after a certain period of time, by default it is 4 hours. If you want to immediately disable these requested JIT accounts, you can leverage idemeum APIs.

Obtain API key

Configure HaloPSA

{
    "customerDisplayName" : "<your_customer_display_name>",
    "technicianEmailAddress" : "<user's email address>"
}

As an example here is what we used:

{
    "customerDisplayName" : "Demo PAM tenant",
    "technicianEmailAddress" : "nik@nikpot.com"
}